hi Splunk Gurus
Looking for some help please
I am trying to extract timestamp from json sent via hec token.
I have my inputs.conf and props.conf in same app and are deployed on heavy forwarders.
My props:
[hec:azure:nonprod:json]
MAX_TIMESTAMP_LOOKAHEAD = 512
TIME_PREFIX = createdDateTime\"\:\s+\"
TIME_FORMAT = %Y-%m-%dT%H:%M:%S%Z
TZ = UTC
Sample event:
{"@odata.type": "#microsoft.graph.group", "id": "XXXXXXXXXXXXX", "deletedDateTime": null, "classification": null, "createdDateTime": "2022-06-03T02:05:02Z", "creationOptions": [], "description": null, "displayName": "global_admin", "expirationDateTime": null, "groupTypes": [], "isAssignableToRole": true, "mail": null, "mailEnabled": false, "mailNickname": "XXXX", "membershipRule": null, "membershipRuleProcessingState": null, "onPremisesDomainName": null, "onPremisesLastSyncDateTime": null, "onPremisesNetBiosName": null, "onPremisesSamAccountName": null, "onPremisesSecurityIdentifier": null, "onPremisesSyncEnabled": null, "preferredDataLocation": null, "preferredLanguage": null, "proxyAddresses": [], "renewedDateTime": "2022-06-03T02:05:02Z", "resourceBehaviorOptions": [], "resourceProvisioningOptions": [], "securityEnabled": true, "securityIdentifier": "XXXXXXXXXXXXX", "theme": null, "visibility": "Private", "onPremisesProvisioningErrors": [], "serviceProvisioningErrors": [], "graphendpointtype": "directoryroles"}
Wanted to extract timestamp from createdDateTime field.
I tried TIMESTAMP_FIELDS = createdDateTime,
and
INGEST_EVAL=_time=strptime(spath(_raw,"createdDateTime"), "%Y-%m-%dT%H:%M:%S%Z")
as per previous answers.splunk posts but nothing worked, splunk still picks up index time only.
What am I doing wrong here?
... View more
